[sleuthkit-users] Mac OS Extended (HSF+)

[<sle...@dn...>]

Yes, it looks like "Mac OS Extended" (HSF+ I think).

Can you recommend any other programs that will read deleted files off that type of file system?

The only thing I've been able to find so far is:
VirtualLab Data Recovery 3.7.9
http://www.macupdate.com/info.php/id/10031
which looks to be $99 per 1GB recovered--to much for me.

Thanks, 
Paul



-----Original Message-----
From: Brian
Sent: Sunday, January 09, 2005 11:06 AM
Cc: sle...@li...
Subject: Re: [sleuthkit-users] sleuthkit1.73 install prob MAC OS X
10.3.6



On Jan 7, 2005, at 5:38 PM, sle...@dn... wrote:

>
> First off, I'm using Sleuthkit/Autopsy browser to try to determine if 
> someone deleted files off a iMac with Mac OS 8.5/8.6 installed--is 
> this possible?

TSK/Autopsy does not support the HFS+ file system, so they will 
probably not do what you need.

> Installed on the Sleuthkit/Autopsy working hard drive is:
> Mac OS X 10.3.6 (upgraded from 10.3.2)
>
> I tried installing XCode Tools 1.1, but after install it said there 
> were errors and to try re-installing, so I installed the 
> gcc2.95.2.pkg, gcc3.1.pkg packages separately, successfully.  
> gcc3.3.pkg says, "gcc3.3 cannot be installed on this computer."

I think you should try to get XCode working if you want to compile it.  
I have never installed gcc directly, but according to Seth it may not 
include the header files that you need. So, I would try to get XCode 
working, but it may not even be what you need if you need to analyze 
HFS.

brian